Re: [whatwg/fetch] Allow setting `cookie` header in credential-less CORS requests (#268)

> I didn't explain the "attack surface" bit clearly enough, and I think it's the more important point

I'm still having trouble understanding the attack, despite your explanation here. Isn't this just exactly what sites could already do, by asking their server-side code to send requests with constructed cookie payloads? Is the attack the idea that constructed cookie payloads + ambient authority is unexpected (even though constructed cookie payloads is totally doable already)?

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/268#issuecomment-205778350